This can detect any modifications outside out of this repo to prevent the repo permissions from deviating from what's been declared in Pulumi cc @cpanato